Update BPF arch

[Roeegg2]

Your checklist for this pull request

• I've documented or updated the documentation of every API function and struct this PR changes.
• I've added tests that prove my fix is effective or that my feature works (if possible)

Detailed description

Full details in commit messages.

Resources used:

1. ref1
2. ref2
3. LLVM objdump
4. Linux BPF disassembler
5. GNU binutils objdump (has quite a few errors. Only used for syntax reference)

In case of inconsistencies I followed the resources in the order listed

Some important notes:

• In general I followed the syntax GNU objdump has (since this is what has been mostly used thus far) but there were cases in which I felt like the syntax was misleading or inaccurate so I modified it a bit:

1. Instead of movs32/movs (for any s8,s16,s32), movsx\movsx64 was used, where x is the size of the move
2. Instead of acmp, we use acmpxchg. It's misleading naming it acmp, since this instruction also swaps the data if the comparison is correct.
3. The reason for using na/64 instead of 32/na is simply because that's what is used so far. Doesn't really matter IMO, (and anyway it makes more sense, since 32 bit is the default instruction class, and 64 are the eBPF added ones.)

• The specifications didn't contain information regarding how exactly the packet load instructions look and work, so I followed what llvm-objdump and the Linux dissembler showed (GNU objdump doesn't parse it correctly)

Test plan

All tests green.
...

Closing issues

...

[Rot127]

Excellent job! Thanks a lot for all the effort!

I added quite some comments. Most of them are pretty simple.

Additionally to them, please:

• Add your copyright in SPDX style to the file headers. E.g.:

  // SPDX-FileCopyrightText: 2023 Rot127 <unisono@quyllur.org>
  // SPDX-License-Identifier: BSD-3
  

• please run clang-format -i arch/bpf/* on the files.

Please add some tests to cover:

• is_signed and is_pkt. You have to add the fields in test_detail_bpf.h/c and details.py::test_expected_bpf().
  (You can check what how the imm is hanndled over all files).
  Use be tested with compare_tbool(). In the yaml files you set the values with: 1 == true, 0 == unset, -1 == false.
• The new groups you added.

I know this is tedious stuff, but doing it now, will save us from many bugs in the future.

I also added quite some comments for using the helper functions we already have.
This is important IMO, because those helper functions are better tested, have more asserts and working with them is easier for other devs.
Because one doesn't have to check how "this specific BPF function" works. Also single point of failure etc.

Regarding the name changes:

The specifications didn't contain information regarding how exactly the packet load instructions look and work, so I followed what llvm-objdump and the Linux dissembler showed (GNU objdump doesn't parse it correctly)

This is ok.

For the others. The problem is usually solved via enabling/disabling features (for x86 for example it is Intel or ATT syntax).

The problem with changing names is, people can't google the mnemonics anymore. But when they attempt to, one can't be sure if they found the correct definition of the instruction or deals with some weird undocumented edge case.
In general it is ok to change syntax for better readability. But please make it opt-in via a flag.
By default the syntax should always be as close as possible to the ISA (or RFC in this case).

You can add a CS_OPT_SYNTAX_BPF_CS in capstone.h::cs_opt_value and handle it in BPF_option().
Check the syntax flag in the printer with MI->csh->syntax & CS_OPT_SYNTAX_BPF_CS and set the alternative mnemonic if true.

To extend cstool, just add the option to cstool.c::all_opts.

[Rot127]

Ah, one last request. Please add a short description to the changes you made in docs/cs_v6_release_guide.md::New features. Also document the mnemonic change for the LLVM style load instructions there.

[Roeegg2]

It appears the formatting is wrong even though I ran clang-format?

[Rot127]

It appears the formatting is wrong even though I ran clang-format?

Most files are not formatted yet. But I try to keep the formatting diversion on an acceptable level. This is why I asked you to only format the bpf files :)

Please revert the formatting in the others.

[Rot127]

Nice, almost done. Please just address the last few comments.

[Roeegg2]

Any idea why the macOS tests fail now? I find why is_pkt is set to false

[Rot127]

I think this is the issue with the test. Just a guess though. My mistake, the error is with is_pkt. Not is_subtracted.

Guess you have to check with the debugger why it is set to true. But remove the is_signed: 0 line first or set it to -1. Maybe this is the issue for whatever reason.
I review a last time tomorrow.

[XVilka]

@kabeor

[kabeor]

Great, thanks for your contribution.